n3mes1s's comments

You can find technical details here:

https://www.apple.com/child-safety/pdf/CSAM_Detection_Techni...

ReaQta (https://www.reaqta.com ) | Amsterdam, Remote EU | Full-Time

ReaQta started with a mission to 10x the performance of security teams defending against next-generation threats. ReaQta is changing the game for endpoint security with its award-winning technology and user experience. Our platform is a force-multiplier which enables organizations to future-proof themselves at scale, at a fraction of the cost. The company continues to drive research and innovation around artificial intelligence, machine learning, and behavioral-based analysis and defense to deliver cutting-edge cybersecurity to organizations and governments worldwide. We are the one of the most disruptive and fast growing companies in the rapidly expanding endpoint security market.

- Endpoint Detection Engineer (Linux): https://reaqta.com/team/join-us/3975

- DevOps Engineer: https://reaqta.com/team/join-us/3994

- Cloud Detection Engineer: https://reaqta.com/team/join-us/3974

- Software Engineer (Integrations): https://reaqta.com/team/join-us/3793

There is a sort of opensnitch based on ebpf but not sure is fully feature completed as you intended:

https://github.com/harporoeder/ebpfsnitch

More info about this in the blogpost Docker without Docker[0]

[0] https://fly.io/blog/docker-without-docker/

ReaQta (https://www.reaqta.com ) | Amsterdam, Remote EU | Full-Time

ReaQta started with a mission to 10x the performance of security teams defending against next-generation threats. ReaQta is changing the game for endpoint security with its award-winning technology and user experience. Our platform is a force-multiplier which enables organizations to future-proof themselves at scale, at a fraction of the cost.

The company continues to drive research and innovation around artificial intelligence, machine learning, and behavioral-based analysis and defense to deliver cutting-edge cybersecurity to organizations and governments worldwide. We are the one of the most disruptive and fast growing companies in the rapidly expanding endpoint security market.

- Endpoint Detection Engineer (Linux): https://reaqta.com/team/join-us/3975

- DevOps Engineer: https://reaqta.com/team/join-us/3994

- Cloud Detection Engineer: https://reaqta.com/team/join-us/3974

- Software Engineer (Integrations): https://reaqta.com/team/join-us/3793

Just a note that I think could be important for someone here, the nested virtualization is not currently supported. What this means ? You will not be able to run another hypervisor inside the guest vm.

This is how hypervisor nesting works, a lot of issues, trust me.

Just adding that virtualbox 6 works(ish) [1] with hyper-v thanks to the use of the virtualization API [2] to setup the VM.

[1] https://forums.virtualbox.org/viewtopic.php?f=6&t=90853 [2] https://docs.microsoft.com/en-us/virtualization/api/

some interesting finding:

- https://twitter.com/gN3mes1s/status/798992790436933632

- RU slides http://osday.ru/presentations/duhvalov/9jun.rifinnopolis16-1...

- RU presentation https://www.youtube.com/watch?v=_iEaY_CGcy8

some links related:

- https://www.defcon.org/images/defcon-22/dc-22-presentations/...

- https://www.youtube.com/watch?v=OD2Wxe4RLeU

paper: http://d.muddywatersresearch.com/wp-content/uploads/2016/08/...

maybe....

- http://www.hanselman.com/blog/AptGetForWindowsOneGetAndChoco...

some useful links on rust + rump kernel:

https://gandro.github.io/2015/09/27/rust-on-rumprun/

https://polyfractal.com/post/adding-a-disk-to-a-rust-rumprun...

just to be clear, the hypervisor's code is this one : http://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/src/sys/...

read the hypervisor part of the lwn article: https://lwn.net/SubscriberLink/644675/5be656c24083e53b/

quote: "With kvmtool, we no longer need a BIOS or UEFI; instead we can jump directly into the Linux kernel. Kvmtool is not cost-free, of course; starting kvmtool and creating the CPU contexts takes approximately 30 milliseconds."

panel at rsa https://www.youtube.com/watch?v=qzK9Mj2V6BA

discussion on stackoverflow:

https://stackoverflow.com/questions/22342854/what-is-the-opt...